By: Laura Soukkavong
HARTFORD, Conn. — A medical data breach that exposed the private information of more than 13.3 million people nationwide, including nearly 108,000 Connecticut residents, has resulted in a settlement worth up to $10 million and mandatory security reforms, Connecticut Attorney General William Tong announced Friday.
Tong joined the attorneys general of Michigan and New Jersey in announcing the agreement with Perry Johnson & Associates Inc., Perry Johnson Inc., Perry Johnson & Associates Coding Inc., Perry Johnson & Associates Radiology Inc. and Medical Transcription and Coding Inc. The companies provided health care organizations with services including medical coding, billing and recording.
The agreement requires the companies to pay at least $300,000 in penalties to the three-state coalition. An additional $9.7 million becomes payable to the states if the companies fail to meet the settlement’s terms. Connecticut is to receive $66,666 in penalties and costs. The conditional structure means the full $10 million is not an upfront payment.
Investigators traced the breach to March 2023, when hackers gained access to Perry Johnson & Associates systems using credentials belonging to an employee of its coding operation. The company did not require multifactor authentication for remote access at the time, the Connecticut Attorney General’s Office said.
Over the following months, the hackers collected passwords and accessed unencrypted files containing personal and protected health information. Investigators found that software operated by Perry Johnson Inc. recorded the intruders’ activity but was not configured to alert security staff.
According to the attorney general’s office, the company did not learn of the intrusion until the hackers contacted it two months later.
The exposed records included names, birth dates, home addresses, Social Security numbers, hospital account numbers, diagnoses and insurance information. Medical transcription files also contained clinical information, including laboratory and diagnostic test results and medication names.
The breach affected approximately 107,960 people in Connecticut, according to the state investigation.
“As a result of Perry Johnson companies’ inadequate security measures, hackers were able to get their hands on protected health information for millions of Americans. This settlement includes strong new protections to ensure personal information is secure going forward. Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so,” Tong said in the announcement.
Under the settlement, any of the Perry Johnson companies that maintains protected health information must establish comprehensive information security and incident response programs.
The required changes also include safeguards for multifactor authentication, password management, encryption and asset management, along with annual risk assessments consistent with federal health privacy requirements under HIPAA.
The companies must also adopt policies governing how personal health information is collected, used, retained and disposed of.
The attorney general’s office identified Deputy Associate Attorney General Michele Lucan, chief of its Privacy and Data Security Section, as assisting with the investigation.
The settlement follows an investigation by the three attorneys general into the companies’ handling of sensitive health records and the security failures that left the information exposed.
Source: Connecticut Office of the Attorney General, Nov. 6, 2026.